   (or
    (api-tenant-admin? tenant allowed-paths)
    (contains? allowed-paths tenant)))
+
+(def service-unavailable
+  (-> (response/response "Service Unavailable")
+      (response/status 503)
+      application-json-type))
+
+(def internal-server-error
+  (-> (response/response "Internal server errror")
+      (response/status 500)
+      application-json-type))
 
 (defmethod ig/init-key :akvo.lumen.auth/wrap-api-authorization
   [_ {:keys [authorizer]}]

  (:import com.nimbusds.jose.crypto.RSASSAVerifier
           java.text.ParseException))

(declare tenant-admin?)

(defn tenant-user?
  [{:keys [tenant jwt-claims auth-roles] :as data} issuer]
  (or (tenant-admin? data issuer)
      (contains? auth-roles
                 (format "akvo:lumen:%s" tenant))))

(defn tenant-admin?
  [{:keys [tenant jwt-claims auth-roles]} issuer]
  (contains? auth-roles
             (format "akvo:lumen:%s:admin" tenant)))

(defn admin-path? [{:keys [path-info]}]
  (string/starts-with? path-info "/api/admin/"))

(defn api-path? [{:keys [path-info]}]
  (string/starts-with? path-info "/api/"))

(defn- application-json-type
  "code taken from ring.middleware.json/wrap-json-response"

                                  not-authorized)
            :else not-authorized))))))

(defmethod ig/pre-init-spec :akvo.lumen.auth/wrap-jwt-authorization
  [_]
  (s/keys :req-un [::keycloak-public-client ::auth0-public-client]))

(defmethod ig/init-key :akvo.lumen.auth/wrap-jwt-authorization
  [_ {:keys [keycloak-public-client auth0-public-client]}]
  (wrap-jwt-authorization keycloak-public-client auth0-public-client))


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; API Authorization
;;;

(defn api-tenant-admin?
  [tenant allowed-paths]
